Hi, While working on CVE-2026-66020 (which had a few revision on list), I kept finding several places where virtio-gpu scanout and dmabuf ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has unmapped its memory. Following that path also found stale dmabuf references, duplicated scanout bookkeeping, and inconsistent cleanup between display backends. Those changes touch a lot of area and I have done basic testing with the various backends. I would not recommend backporting them all to stable. The first 2 patches address CVE-2026-66020 in the general case and should be safe to backport. thanks Signed-off-by: Marc-André Lureau <[email protected]> --- Changes in v3: - updated "virtio-gpu: fix use-after-free on blob cursor", now "clear res->blob on mapping cleanup" - always disable GL when clearning scanout in "virtio-gpu: consolidate disabling scanout" - drop "vhost-user-gpu: release DMA-BUFs on scanout disable" for now - rebased, collect rb trailers - Link to v2: https://lore.kernel.org/qemu-devel/[email protected] Changes in v2: addresses Akihiko review - reorder to have CVE fix first, easily back-portable (but also more limited fix) - include virtio_gpu_{simple,virgl}_resource_new() patch, and other sent separately - move draw_submitted from QemuDmaBuf to VirtualGfxConsole - contrib/vhost-user-gpu: disable scanouts on resource unref - drop rfc, collect rb, adjust commit messages - Link to v1: https://lore.kernel.org/qemu-devel/[email protected] --- Marc-André Lureau (24): virtio-gpu: disable blob scanouts on mapping cleanup virtio-gpu: clear res->blob on mapping cleanup hw/display/virtio-gpu: introduce virtio_gpu_{simple,virgl}_resource_new() virtio-gpu/virgl: free BHs and timers on renderer reset hw/display/virtio-gpu: set share_handle for udmabuf blob resources ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole ui/dbus: disable scanout iff dmabuf is current virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout ui/console: disable GL scanout when dmabuf is the active one ui/sdl2: clear guest_fb.dmabuf on release ui/dmabuf: own and close fds on free ui: make GL context current before releasing DMA-BUF textures virtio-gpu: release the dmabuf when a scanout is disabled contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping virtio-gpu-rutabaga: fix scanout handling virtio-gpu: drop scanout_bitmask bookkeeping virtio-gpu: release dmabuf when switching to a surface virtio-gpu/virgl: release dmabuf when a texture replaces a scanout virtio-gpu: consolidate disabling scanout virtio-gpu: minor refactoring virtio-gpu/virgl: disable scanouts on resource unref virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper contrib/vhost-user-gpu: disable scanouts on resource unref contrib/vhost-user-gpu/vhost-user-gpu.c | 28 ++---- contrib/vhost-user-gpu/virgl.c | 12 +++ hw/display/vhost-user-gpu.c | 1 - hw/display/virtio-gpu-rutabaga.c | 38 ++++---- hw/display/virtio-gpu-udmabuf-stubs.c | 2 +- hw/display/virtio-gpu-udmabuf.c | 89 ++++++------------- hw/display/virtio-gpu-virgl.c | 131 +++++++++++++++++----------- hw/display/virtio-gpu.c | 150 +++++++++++++++++++++----------- hw/vfio/display.c | 1 - include/hw/virtio/virtio-gpu.h | 31 ++++--- include/ui/dmabuf.h | 7 -- include/ui/egl-helpers.h | 4 +- include/ui/gtk.h | 14 ++- ui/console.c | 3 + ui/dbus-listener.c | 69 ++++++++++----- ui/dmabuf.c | 64 ++------------ ui/egl-headless.c | 2 + ui/egl-helpers.c | 15 ++-- ui/gtk-egl.c | 55 +++++++----- ui/gtk-gl-area.c | 33 ++++--- ui/gtk.c | 43 +++++---- ui/sdl2-gl.c | 6 ++ ui/spice-display.c | 2 + 23 files changed, 432 insertions(+), 368 deletions(-) --- base-commit: 1df256f5968e9f7c3c4533a1383b071c044a36d6 change-id: 20260825-virtio-gpu-cleanup-dfb2ba185936 Best regards, -- Marc-André Lureau <[email protected]>
